Question

If you notice an unusually high number of login attempts, what specific log file property should you audit to distinguish between a brute-force attack and a misconfigured software agent?

Accepted Answer

To figure out if you are dealing with a hacker or just a broken computer program, you should look at the source IP address in your logs. The source IP address is the digital home address that tells you exactly where a request is coming from on the internet. If you see thousands of failed login attempts coming from many different home addresses all over the world, it is almost certainly a brute-force attack where someone is guessing passwords. If you see all those attempts coming from just one single home address, it is likely a misconfigured software agent. Think of it like someone trying to get into your house; if one person keeps trying the wrong key over and over, they probably just forgot their own key, but if a hundred different people show up at once trying to pick the lock, you know you are under attack.

If you notice an unusually high number of login attempts, what specific log file property should you audit to distinguish between a brute-force attack and a misconfigured software agent?

To figure out if you are dealing with a hacker or just a broken computer program, you should look at the source IP address in your logs. The source IP address is the digital home address that tells you exactly where a request is coming from on th....

Community Answers

Home → All Courses → Engineering and Technology Courses → CyberArk Training → Flashcard

If you notice an unusually high number of login attempts, what specific log file property should you audit to distinguish between a brute-force attack and a misconfigured software agent?

To figure out if you are dealing with a hacker or just a broken computer program, you should look at the source IP address in your logs. The source IP address is the digital home address that tells you exactly where a request is coming from on th....

Community Answers